Linux: add next-protocol-negotiation to libssl.

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code GetDefaultCertNickname(), derived from
 // nsNSSCertificate::defaultServerNickName()
 // in mozilla/security/manager/ssl/src/nsNSSCertificate.cpp
 // and SSLClientSocketNSS::DoVerifyCertComplete() derived from
 // AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
@@ skipping 344 matching lines @@
 #else
   #error "You need to install NSS-3.12 or later to build chromium"
 #endif
 
 #ifdef SSL_ENABLE_DEFLATE
   rv = SSL_OptionSet(nss_fd_, SSL_ENABLE_DEFLATE, PR_TRUE);
   if (rv != SECSuccess)
      LOG(INFO) << "SSL_ENABLE_DEFLATE failed.  Old system nss?";
 #endif
 
+#ifdef SSL_NEXT_PROTO_NEGOTIATED
+  if (!ssl_config_.next_protos.empty()) {
+    rv = SSL_SetNextProtoNego(
+       nss_fd_,
+       reinterpret_cast<const unsigned char *>(ssl_config_.next_protos.data()),
+       ssl_config_.next_protos.size());
+    if (rv != SECSuccess)
+       LOG(INFO) << "SSL_SetNextProtoNego failed.";
+  }
+#endif
+
   rv = SSL_OptionSet(nss_fd_, SSL_HANDSHAKE_AS_CLIENT, PR_TRUE);
   if (rv != SECSuccess)
      return ERR_UNEXPECTED;
 
   rv = SSL_AuthCertificateHook(nss_fd_, OwnAuthCertHandler, this);
   if (rv != SECSuccess)
      return ERR_UNEXPECTED;
 
   rv = SSL_GetClientAuthDataHook(nss_fd_, ClientAuthHandler, this);
   if (rv != SECSuccess)
@@ skipping 173 matching lines @@
     } else {
       ssl_info->security_bits = -1;
       LOG(DFATAL) << "SSL_GetCipherSuiteInfo returned " << PR_GetError()
                   << " for cipherSuite " << channel_info.cipherSuite;
     }
     UpdateServerCert();
   }
   ssl_info->cert_status = server_cert_verify_result_.cert_status;
   DCHECK(server_cert_ != NULL);
   ssl_info->cert = server_cert_;
+
+#ifdef SSL_NEXT_PROTO_NEGOTIATED
+  unsigned char npn_buf[255];
+  unsigned npn_len;
+  int npn_status;
+  SECStatus rv = SSL_GetNextProto(nss_fd_, &npn_status, npn_buf, &npn_len,
+                                  sizeof(npn_buf));
+  if (rv != SECSuccess) {
+    npn_status = SSL_NEXT_PROTO_NO_SUPPORT;
+  }
+
+  if (npn_status == SSL_NEXT_PROTO_NO_SUPPORT) {
+    ssl_info->next_proto_status = SSLInfo::kNextProtoUnsupported;
+    ssl_info->next_proto.clear();
+  } else {
+    ssl_info->next_proto =
+      std::string(reinterpret_cast<const char *>(npn_buf), npn_len);
+    switch (npn_status) {
+      case SSL_NEXT_PROTO_NEGOTIATED:
+        ssl_info->next_proto_status = SSLInfo::kNextProtoNegotiated;
+        break;
+      case SSL_NEXT_PROTO_NO_OVERLAP:
+        ssl_info->next_proto_status = SSLInfo::kNextProtoNoOverlap;
+        break;
+      default:
+        LOG(ERROR) << "Unknown npn_status: " << npn_status;
+        ssl_info->next_proto_status = SSLInfo::kNextProtoNoOverlap;
+        break;
+    }
+  }
+#endif
+
   LeaveFunction("");
 }
 
 void SSLClientSocketNSS::GetSSLCertRequestInfo(
     SSLCertRequestInfo* cert_request_info) {
   EnterFunction("");
   cert_request_info->host_and_port = hostname_;
   cert_request_info->client_certs = client_certs_;
   LeaveFunction(cert_request_info->client_certs.size());
 }
@@ skipping 568 matching lines @@
   }
   PRErrorCode prerr = PR_GetError();
   if (prerr == PR_WOULD_BLOCK_ERROR) {
     return ERR_IO_PENDING;
   }
   LeaveFunction("");
   return NetErrorFromNSPRError(prerr);
 }
 
 }  // namespace net